EC2 instance does not allow ingress from the Internet to TCP ports 27017 or 27018 (MongoDB)
ec2_instance_port_mongodb_exposed_to_internet
EC2 instances with security groups permitting inbound TCP 27017 or 27018 (MongoDB) from 0.0.0.0/0 or ::/0 are identified, factoring the instance's public reachability to gauge exposure.
Risk
Internet-exposed MongoDB invites scanning, brute force, and exploits leading to:
- Data extraction (confidentiality)
- Collection tampering or deletion (integrity)
- DoS or ransomware disruptions (availability) A compromised DB host can also enable lateral movement within the environment.
prowler aws --checks ec2_instance_port_mongodb_exposed_to_internet
prowler aws --checks ec2_instance_port_mongodb_exposed_to_internet --fixer
Recommendation
Apply least privilege to MongoDB access:
- Remove Internet-wide rules; allow only trusted sources
- Keep DBs on private subnets without public IPs; use private connectivity or proxies
- Enforce strong auth and TLS
- Add segmentation and monitoring for defense in depth
Remediation
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":27017,"ToPort":27017,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":27018,"ToPort":27018,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'
- In the AWS Console, go to EC2 > Security Groups
- Select the security group attached to the affected instance
- Open the Inbound rules tab and click Edit inbound rules
- Delete any rule allowing TCP port 27017 or 27018 from 0.0.0.0/0 or ::/0
- If access is required, add a rule for those ports limited to a specific trusted CIDR (e.g., your VPC CIDR)
- Click Save rules
Source Code
Resource Type
AwsEc2Instance